@teamscala/service-boot 0.23.500 → 0.23.501

package/package.json

@@ -1130,5 +1130,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.500"
+  "version": "0.23.501"
 }

package/src/content-gate/access.ts

@@ -37,14 +37,27 @@ export async function attachContentGateAccess(
 		let resourceId = "";
 		let email = "";
 		let name = "";
+		let phone = "";
 		let bodyFailed = false;
+		// The resource id may ride on the URL instead of the body. A gate whose
+		// form is COMPOSED FROM BLOCKS has no place to put a hidden field — the
+		// generic submit action collects the visible inputs and adds only the
+		// static fields its row declares, and a row is shared by every page so it
+		// cannot carry a per-page id. The gate therefore publishes its own access
+		// URL with the id already on it (see quiz-gate onUnauthorized), which
+		// keeps the id single-sourced from the resolved graph. A body field still
+		// wins where one is posted (proposals, agreements, the GPT).
+		const queryResourceId = String(c.req.query(config.recordIdField) ?? "").trim();
 		try {
 			const form = await c.req.parseBody();
-			resourceId = String(form[config.recordIdField] ?? "").trim();
+			resourceId = String(form[config.recordIdField] ?? "").trim() || queryResourceId;
 			email = String(form.email ?? "").trim().toLowerCase();
 			// Optional captured display name (open-capture gates carry it in the
 			// token; allow-list gates ignore it via signToken).
 			name = String(form.name ?? "").trim();
+			// Captured alongside the email by an open-capture gate's composed
+			// form. It rides in the signed token rather than any client store.
+			phone = String(form.phone ?? "").trim();
 		} catch (error) {
 			log.warn(`[content-gate:${config.cookieName}] body parse failed — redirecting back: ${String(error)}`);
 			bodyFailed = true;
@@ -75,7 +88,13 @@ export async function attachContentGateAccess(
 			return c.redirect(`${back}${sep}gate_error=1`, 302);
 		}
 
-		const token = config.signToken(resourceId, email, Date.now(), name || undefined);
+		const token = config.signToken(
+			resourceId,
+			email,
+			Date.now(),
+			name || undefined,
+			phone || undefined,
+		);
 		if (token) {
 			const maxAge = Math.floor(config.ttlMs / 1000);
 			c.header(

package/src/content-gate/catalog.ts

@@ -58,6 +58,7 @@ import type { AccessConfig, ContentGateConfig } from "./config-types.ts";
 import { agreementAccessConfig, agreementGateConfig } from "../agreement-gate.ts";
 import { gptAccessConfig, gptGateConfig } from "../gpt-gate.ts";
 import { proposalAccessConfig, proposalGateConfig } from "../proposal-gate.ts";
+import { quizAccessConfig, quizGateConfig } from "../quiz-gate.ts";
 
 /** One gated content type: its SSR gate and its public access endpoint. */
 export interface ContentGateEntry {
@@ -71,6 +72,7 @@ export const CONTENT_GATES: readonly ContentGateEntry[] = [
 	{ slug: "proposal", gate: proposalGateConfig, access: proposalAccessConfig },
 	{ slug: "agreement", gate: agreementGateConfig, access: agreementAccessConfig },
 	{ slug: "gpt", gate: gptGateConfig, access: gptAccessConfig },
+	{ slug: "quiz", gate: quizGateConfig, access: quizAccessConfig },
 ];
 
 export function withholdsContent(entry: ContentGateEntry): boolean {

package/src/content-gate/config-types.ts

@@ -35,7 +35,7 @@ export interface ContentGateConfig {
 		token: string | undefined,
 		resourceId: string,
 		nowMs: number,
-	): { email: string; name?: string } | null;
+	): { email: string; name?: string; phone?: string } | null;
 	/**
 	 * BAKED-IN unified auth. When a gate provides this resolver, the engine
 	 * AUTOMATICALLY releases a logged-in viewer whose session email is in the
@@ -64,7 +64,7 @@ export interface ContentGateConfig {
 	onAuthorized(
 		resolved: Resolved,
 		resourceId: string,
-		identity: { email: string; name?: string },
+		identity: { email: string; name?: string; phone?: string },
 	): void | Promise<void>;
 	/** Withhold content (strip/inject the gate) — token absent/invalid. Async-
 	 *  capable so a gate can load its display/behaviour settings from a registry
@@ -96,13 +96,15 @@ export interface AccessConfig {
 	resolveAuthorizedEmails(resourceId: string): Promise<Set<string>>;
 	/**
 	 * Mint the access token for a matched email (token-agnostic per gate).
-	 * `name` is the optional captured display name (open-capture gates carry it
-	 * in the token; allow-list gates ignore it).
+	 * `name` and `phone` are the optional captured identity (open-capture gates
+	 * carry them in the token; allow-list gates ignore them). They exist so a
+	 * capture gate needs no browser storage to remember who this is.
 	 */
 	signToken(
 		resourceId: string,
 		email: string,
 		nowMs: number,
 		name?: string,
+		phone?: string,
 	): string | null;
 }

package/src/content-gate/token.ts

@@ -9,7 +9,9 @@
  * the only thing that releases the content into the SSR, so without it a gated
  * page is never readable/scrapable by a link holder.
  *
- * HMAC-SHA256 (Bun-native) over {c:cookieName, r:resourceId, e:email, x:exp}.
+ * HMAC-SHA256 (Bun-native) over {c:cookieName, r:resourceId, e:email, x:exp},
+ * plus the optional captured identity a lead-capture gate carries (n:name,
+ * p:phone) so a returning visitor is fully known at SSR with NO client storage.
  * `cookieName` is bound INTO the payload so a token minted for one gate
  * (e.g. ag_token) can never satisfy another gate's check (e.g. prop_token).
  *
@@ -59,10 +61,17 @@ export function signAccessToken(
 	 * (proposals/agreements) omit it.
 	 */
 	name?: string,
+	/**
+	 * Optional captured phone, same reasoning as `name`. It exists so a capture
+	 * gate needs NO browser storage to remember it: the operator's ruling is
+	 * that identity lives in the database and the request, never in
+	 * localStorage.
+	 */
+	phone?: string,
 ): string | null {
 	const key = secret();
 	if (!key) return null;
-	const payload: { c: string; r: string; e: string; x: number; n?: string } = {
+	const payload: { c: string; r: string; e: string; x: number; n?: string; p?: string } = {
 		c: cookieName,
 		r: resourceId,
 		e: email.trim().toLowerCase(),
@@ -70,6 +79,8 @@ export function signAccessToken(
 	};
 	const trimmedName = name?.trim();
 	if (trimmedName) payload.n = trimmedName;
+	const trimmedPhone = phone?.trim();
+	if (trimmedPhone) payload.p = trimmedPhone;
 	const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
 	return `${payloadB64}.${hmac(payloadB64, key)}`;
 }
@@ -110,7 +121,7 @@ export function verifyAccessToken(
 }
 
 /**
- * Like `verifyAccessToken` but returns the full verified identity ({email, name})
+ * Like `verifyAccessToken` but returns the full verified identity ({email, name, phone})
  * so a gate that carries a display name in the token (the public GPT lead-capture
  * gate) can seed the visitor's name — not just the email — at SSR. Same
  * signature/expiry/gate-binding checks; null on any failure.
@@ -120,7 +131,7 @@ export function verifyAccessTokenIdentity(
 	cookieName: string,
 	resourceId: string,
 	nowMs: number,
-): { email: string; name?: string } | null {
+): { email: string; name?: string; phone?: string } | null {
 	if (!token) return null;
 	const key = secret();
 	if (!key) return null;
@@ -136,12 +147,17 @@ export function verifyAccessTokenIdentity(
 			e?: string;
 			x?: number;
 			n?: string;
+			p?: string;
 		};
 		if (p.c !== cookieName) return null;
 		if (p.r !== resourceId) return null;
 		if (typeof p.x !== "number" || p.x < nowMs) return null;
 		if (typeof p.e !== "string") return null;
-		return { email: p.e, name: typeof p.n === "string" ? p.n : undefined };
+		return {
+			email: p.e,
+			name: typeof p.n === "string" ? p.n : undefined,
+			phone: typeof p.p === "string" ? p.p : undefined,
+		};
 	} catch {
 		return null;
 	}

package/src/gate-ttls.ts

@@ -4,7 +4,7 @@
  * @edit edit directly
  *
  * Cached readers for the content-gate access-token TTL config rows
- * (agreement-gate / proposal-gate / gpt-gate). initGateTtls() runs once at boot
+ * (agreement-gate / proposal-gate / gpt-gate / quiz-gate). initGateTtls() runs once at boot
  * (two-phase-boot, before the gates mount) to populate the cache from the
  * registry rows; the sync getters (agTtlMs/propTtlMs/gptTtlMs) return the
  * cached value — or the former hardcoded default before init / on row-miss — so
@@ -20,10 +20,14 @@ import * as v from "valibot";
 const DEFAULT_AG_TTL_MS = 30 * 60 * 1000;
 const DEFAULT_PROP_TTL_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_GPT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+// A quiz visitor returns to finish or to re-read their result over days, so the
+// identity cookie outlives one sitting — same lead-capture shape as the GPT.
+const DEFAULT_QUIZ_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 
 let _agTtlMs = DEFAULT_AG_TTL_MS;
 let _propTtlMs = DEFAULT_PROP_TTL_MS;
 let _gptTtlMs = DEFAULT_GPT_TTL_MS;
+let _quizTtlMs = DEFAULT_QUIZ_TTL_MS;
 let _initialized = false;
 
 /** Populate the TTL cache from the registry rows. Idempotent; keeps defaults on
@@ -32,14 +36,16 @@ export async function initGateTtls(): Promise<void> {
 	if (_initialized) return;
 	_initialized = true;
 	try {
-		const [ag, prop, gpt] = await Promise.all([
+		const [ag, prop, gpt, quiz] = await Promise.all([
 			loadRegistryConfig("config", "agreement-gate", v.looseObject({})),
 			loadRegistryConfig("config", "proposal-gate", v.looseObject({})),
 			loadRegistryConfig("config", "gpt-gate", v.looseObject({})),
+			loadRegistryConfig("config", "quiz-gate", v.looseObject({})),
 		]);
 		if (typeof ag?.ag_ttl_ms === "number") _agTtlMs = ag.ag_ttl_ms;
 		if (typeof prop?.prop_ttl_ms === "number") _propTtlMs = prop.prop_ttl_ms;
 		if (typeof gpt?.gpt_ttl_ms === "number") _gptTtlMs = gpt.gpt_ttl_ms;
+		if (typeof quiz?.quiz_ttl_ms === "number") _quizTtlMs = quiz.quiz_ttl_ms;
 	} catch {
 		// keep defaults
 	}
@@ -54,3 +60,6 @@ export function propTtlMs(): number {
 export function gptTtlMs(): number {
 	return _gptTtlMs;
 }
+export function quizTtlMs(): number {
+	return _quizTtlMs;
+}

package/src/quiz-gate.ts

@@ -0,0 +1,87 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The PUBLIC QUIZ identity gate, expressed as config for the content-gate
+ * primitive. Like the GPT gate this is lead capture, not access control: every
+ * email is a valid visitor. Its job is to make the visitor KNOWN AT SSR so the
+ * page's identity blocks hide themselves and the quiz blocks reveal themselves
+ * — by block condition on `initialVisitor`, never by a component deciding which
+ * screen to render.
+ *
+ * That is the whole point of this file existing. The quiz identity form used to
+ * be a composite React component that hand-assembled a logo, a heading, three
+ * inputs and a button, and then branched in TypeScript on whether a visitor was
+ * known. Every one of those pieces is already a Puck block, and the branch is
+ * already expressible as a block condition — what was missing was only the
+ * server half: something to turn a submitted email into a visitor the next
+ * render can see. This is that half, and it is 60 lines of config because the
+ * engine (content-gate/gate.ts + access.ts) already does the work.
+ *
+ * Flow: the composed form POSTs {quizId, name, email, phone} to
+ * /api/quiz-access (openCapture → any email matches); the access endpoint signs
+ * a `quiz_token` cookie and redirects back. On the next request runContentGate
+ * verifies it for this assessment and seeds resolved.initialVisitor.
+ */
+
+import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
+import { signAccessToken, verifyAccessTokenIdentity } from "./content-gate/token.ts";
+import { quizTtlMs } from "./gate-ttls.ts";
+
+const QUIZ_COOKIE = "quiz_token";
+const QUIZ_ACCESS_PATH = "/api/quiz-access";
+
+/** The assessment this page is for, from the quiz-with-brand loader's graph. */
+function quizId(resolved: Record<string, unknown>): string {
+	const quiz = resolved.quiz as { id?: unknown } | null | undefined;
+	return typeof quiz?.id === "string" ? quiz.id : "";
+}
+
+export const quizGateConfig: ContentGateConfig = {
+	cookieName: QUIZ_COOKIE,
+	getResourceId(resolved) {
+		// No quiz in the graph → not a quiz page → the engine no-ops.
+		return quizId(resolved);
+	},
+	verifyToken(token, resourceId, nowMs) {
+		return verifyAccessTokenIdentity(token, QUIZ_COOKIE, resourceId, nowMs);
+	},
+	onAuthorized(resolved, _resourceId, { email, name, phone }) {
+		// The one fact the page's block conditions read. Present → the identity
+		// container hides and the quiz container shows; absent → the reverse.
+		(resolved as {
+			initialVisitor?: { name?: string; email: string; phone?: string };
+		}).initialVisitor = { name, email, phone };
+	},
+	onUnauthorized(resolved, resourceId) {
+		// The endpoint the identity form posts to, PUBLISHED INTO THE PAGE DATA
+		// rather than typed into the page. The assessment id is per-page, so a
+		// static row could not carry it and a literal in the page tree would be
+		// a second copy of the id the URL already states. The submit Button
+		// resolves this by field path (page-data → loaderData), exactly as it
+		// resolves any other live value.
+		(resolved as { quizAccess?: { url: string } }).quizAccess = {
+			url: `${QUIZ_ACCESS_PATH}?quizId=${encodeURIComponent(resourceId)}`,
+		};
+	},
+};
+
+export const quizAccessConfig: AccessConfig = {
+	path: QUIZ_ACCESS_PATH,
+	cookieName: QUIZ_COOKIE,
+	get ttlMs() {
+		return quizTtlMs();
+	},
+	recordIdField: "quizId",
+	// Lead capture: any email identifies a visitor. Nothing is withheld — the
+	// quiz is public, only the answers are attributed.
+	openCapture: true,
+	// Never called under openCapture; present to satisfy the config contract.
+	async resolveAuthorizedEmails() {
+		return new Set<string>();
+	},
+	signToken(resourceId, email, nowMs, name, phone) {
+		return signAccessToken(QUIZ_COOKIE, resourceId, email, nowMs, quizTtlMs(), name, phone);
+	},
+};